CVE-2026-47385: NocoDB Path Traversal Vulnerability

CVE-2026-47385 Overview

NocoDB is an open-source platform for building databases as spreadsheets. CVE-2026-47385 is a path traversal vulnerability [CWE-22] affecting NocoDB versions prior to 2026.05.1. An authenticated user holding base-create permission can attach a SQLite source pointing to an arbitrary file on the NocoDB host. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open('w') without restricting the location. Attackers can target noco.db, tenant databases under nc_minimal_dbs/, or any writable path the NocoDB process can reach. The flaw is fixed in version 2026.05.1.

Critical Impact
Authenticated users with base-create permission can read or overwrite arbitrary files accessible to the NocoDB process, including NocoDB's internal databases.

Affected Products

NocoDB versions prior to 2026.05.1
NocoDB SQLite client and base/integration create services
Self-hosted NocoDB deployments exposing base creation to authenticated tenants

Discovery Timeline

2026-06-23 - CVE-2026-47385 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-47385

Vulnerability Analysis

The vulnerability resides in NocoDB's handling of SQLite source connections. When an authenticated user creates a base or integration backed by SQLite, the application accepts a filename string supplied by the caller. That filename is forwarded directly to fs.exists and fs.open('w') without canonicalization or allow-list enforcement.

Because NocoDB exposes regular table APIs over the resulting source, the attacker gains read and write primitives against whatever file path is configured. Targets include NocoDB's own metadata store noco.db, tenant databases under nc_minimal_dbs/, and any other writable path the NocoDB process can reach.

An attacker leveraging this flaw can tamper with NocoDB internal state, escalate privileges by rewriting user records, or exfiltrate tenant data across isolation boundaries. Impact is confined to confidentiality and integrity of files accessible to the service account; availability impact is rated none.

Root Cause

The root cause is missing path validation on user-controlled input. The SQLite client and the base/integration create services trusted the supplied filename and used it as a filesystem path argument. No allow-list, sandbox directory, or canonical path comparison guarded the fs calls, enabling traversal outside the intended source storage directory.

Attack Vector

The attack is network-reachable and requires an authenticated account with base-create permission. The attacker submits a base or integration creation request that references an arbitrary SQLite filename. NocoDB then attaches the path as a managed source, and subsequent table API calls read from or write to the targeted file.

See the GitHub Security Advisory GHSA-wvqj-9wv4-7ff5 for additional technical details.

Detection Methods for CVE-2026-47385

Indicators of Compromise

Base or integration records in NocoDB metadata pointing at filesystem paths outside the expected SQLite storage directory, such as noco.db or paths traversing parent directories.
Unexpected modification timestamps on noco.db or files under nc_minimal_dbs/ that do not correlate with legitimate administrative activity.
Audit log entries showing base creation calls with filename parameters containing .., absolute paths, or references to system files.

Detection Strategies

Review NocoDB application logs for source creation events and extract the filename parameter for inspection against an allow-listed directory.
Monitor the NocoDB process for open, openat, and write syscalls targeting paths outside its expected data directory using eBPF or auditd rules.
Correlate authenticated user activity with file write events on the host to identify base-create operations followed by writes to sensitive paths.

Monitoring Recommendations

Enable file integrity monitoring on noco.db, nc_minimal_dbs/, and any directory holding NocoDB configuration or secrets.
Alert on creation of SQLite sources whose filename does not match the expected base directory prefix.
Track accounts holding base-create permission and flag anomalous source creation rates per user.

How to Mitigate CVE-2026-47385

Immediate Actions Required

Upgrade NocoDB to version 2026.05.1 or later, which restricts caller-supplied SQLite filenames to a safe directory.
Audit existing bases and integrations for SQLite sources referencing paths outside the intended storage directory and remove suspect entries.
Review the membership of roles granting base-create permission and revoke access for users who do not require it.

Patch Information

The vulnerability is fixed in NocoDB 2026.05.1. The patched release constrains SQLite source filenames so that fs.exists and fs.open('w') only operate within the approved source directory. Refer to the GitHub Security Advisory GHSA-wvqj-9wv4-7ff5 for the upstream fix.

Workarounds

Restrict the base-create permission to trusted administrators until the patch can be applied.
Run NocoDB under a dedicated low-privilege service account with filesystem access limited to its intended data directory.
Place NocoDB's data directory on a mount with no access to noco.db siblings or other sensitive files, using container or filesystem-level isolation.

bash

# Configuration example: upgrade NocoDB to the patched release
docker pull nocodb/nocodb:2026.05.1
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb \
  -v /srv/nocodb/data:/usr/app/data \
  --read-only --tmpfs /tmp \
  -p 8080:8080 \
  nocodb/nocodb:2026.05.1